Skip to content

graphify

v0.7.10 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 27d RAG & Retrieval
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

antigravity claude-code codex gemini graphrag knowledge-graph
+5 more
leiden openclaw llm skills tree-sitter

Summary

AI summary

Fixed JSX parsing for .tsx files, normalized edges key to links in saved graphs, and removed unsupported resourceKey query param from Google Workspace export.

Full changelog

What's new

  • Fix: .tsx files now use language_tsx grammar for JSX-aware parsing -- previously language_typescript was used, silently dropping all JSX-specific nodes from .tsx files (#766)
  • Fix: edges key in saved graph JSON now normalised to links before loading -- prevents KeyError: 'links' on graphs written by older NetworkX versions in query, path, explain, and serve (#768)
  • Fix: Google Workspace gws export drops unsupported resourceKey query param -- Drive API requires it as an HTTP header; sending it as a query param was a silent no-op (#772)
  • Security: eleven hardening fixes -- Cypher escape strips C0 control chars and \n/\r; YAML frontmatter escapes U+2028, U+2029, tabs, and C0; MCP sanitize_label applied to all LLM-derived fields; C preprocessor blocked from #include exfiltration via -nostdinc -I /dev/null; merge-driver 50 MB file size cap and 100k node cap; detect_backend() places Ollama last so paid API keys take precedence over ambient OLLAMA_BASE_URL; Neo4j --password reads from NEO4J_PASSWORD env var by default; hooks exception handling narrowed to (configparser.Error, OSError)
  • Refactor: skill YAML descriptions rewritten to be trigger-oriented -- describe what invokes the skill rather than its internal pipeline (#774)
  • Refactor: generated CLAUDE.md / AGENTS.md / GEMINI.md templates strengthened with ALWAYS/NEVER/IF ... EXISTS graph-first directives (#775)

Install / upgrade

pip install -U graphifyy

Security Fixes

  • Cypher escape strips C0 control chars and \n/\r; YAML frontmatter escapes U+2028, U+2029, tabs, and C0; MCP sanitize_label applied to all LLM‑derived fields; C preprocessor blocked from #include exfiltration via -nostdinc -I /dev/null; merge-driver limited to 50 MB files and 100k nodes; detect_backend() places Ollama last for API key precedence; Neo4j --password reads from NEO4J_PASSWORD env var by default; hooks exception handling narrowed to configparser.Error, OSError
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track graphify

Get notified when new releases ship.

Sign up free

About graphify

AI coding assistant skill (Claude Code, Codex, OpenCode, Cursor, Gemini CLI, OpenClaw, Factory Droid, Trae). Turn any folder of code, docs, papers, images, videos, or YouTube links into a queryable knowledge graph

All releases →

Related context

Earlier breaking changes

  • v0.8.18 Breaks Java `extends` edges; they are renamed to `inherits`. Update queries filtering on `relation="extends"` for Java nodes.

Beta — feedback welcome: [email protected]